Update fastapi to 0.137.1 - #582
Conversation
📝 WalkthroughWalkthroughThe Changesfastapi Dependency Bump
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/requirements.txt`:
- Around line 1-3: Update the uvicorn version specification from 0.4.6 to 0.27.0
or newer in the requirements.txt file. The current version 0.4.6 is incompatible
with FastAPI 0.137.1 and contains unpatched security vulnerabilities
(CVE-2020-7694 and CVE-2020-7695). Change the line that currently reads
uvicorn==0.4.6 to uvicorn==0.27.0 (or a newer stable release) to ensure
compatibility and patch the known security issues.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| fastapi==0.137.1 | ||
| gitpython | ||
| uvicorn==0.4.6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find minimum compatible uvicorn version for fastapi 0.137.1
pip index versions fastapi==0.137.1 2>/dev/null | grep -A 5 'uvicorn'
# Or check FastAPI's pyproject.toml or setup.py for uvicorn dependency constraintsRepository: salimfadhley/dockerized_python_playground
Length of output: 67
🏁 Script executed:
cat -n src/requirements.txtRepository: salimfadhley/dockerized_python_playground
Length of output: 148
🏁 Script executed:
git ls-files | head -20Repository: salimfadhley/dockerized_python_playground
Length of output: 508
🏁 Script executed:
fd pyproject.toml setup.py setup.cfg -type fRepository: salimfadhley/dockerized_python_playground
Length of output: 256
🌐 Web query:
uvicorn 0.4.6 fastapi 0.137.1 compatibility
💡 Result:
Uvicorn 0.4.6 and FastAPI 0.137.1 are not recommended for use together due to the significant age gap between them [1][2][3]. Uvicorn 0.4.6 was released on February 25, 2019 [1][4], and FastAPI 0.137.1 was released in June 2026 [5][6]. FastAPI is designed to run on top of modern ASGI servers that implement current ASGI specifications [7]. Using such an outdated version of Uvicorn with a current version of FastAPI will likely result in compatibility issues, missing features, and security vulnerabilities [8]. For a functional and secure FastAPI application, you should use a modern, up-to-date version of Uvicorn [9][7]. The recommended approach is to install the standard extra, which ensures you have the necessary dependencies for performance and full feature support [10][7]: pip install "uvicorn[standard]" This will provide you with a version compatible with current FastAPI releases, ensuring proper support for ASGI features, event loop management, and WebSocket handling [10][11].
Citations:
- 1: https://www.piwheels.org/project/uvicorn/
- 2: https://deps.dev/pypi/uvicorn/0.6.1/versions
- 3: https://pypi.org/project/fastapi/
- 4: https://simple-repository.app.cern.ch/project/uvicorn
- 5: https://fastapi.tiangolo.com/release-notes/
- 6: https://github.com/fastapi/fastapi/releases
- 7: https://fastapi.tiangolo.com/deployment/manually/
- 8: https://pypi.org/project/uvicorn/0.4.6/
- 9: https://uvicorn.dev/
- 10: https://uvicorn.dev/installation/
- 11: https://uvicorn.dev/settings/
🌐 Web query:
uvicorn 0.4.6 security vulnerabilities CVE PYSEC
💡 Result:
Uvicorn version 0.4.6 is affected by at least two major security vulnerabilities, both of which were addressed in version 0.11.7 [1][2]. The vulnerabilities are: 1. ANSI Escape Sequence Injection (CVE-2020-7694 / PYSEC-2020-150 / GHSA-33c7-2mpw-hg34): The application's request logger is vulnerable to ANSI escape sequence injection [3][4]. Attackers can supply crafted URLs containing percent-encoded escape sequences, which the logging component processes and writes to logs [3][5]. This allows attackers to pollute access logs or potentially interact with terminal emulators displaying the logs [3][6]. 2. HTTP Response Splitting (CVE-2020-7695 / PYSEC-2020-151 / GHSA-f97h-2pfx-f59f): Uvicorn versions prior to 0.11.7 are vulnerable to HTTP response splitting [7][8]. The issue arises because CRLF sequences are not properly escaped in HTTP header values [9][8]. This vulnerability can be exploited to inject arbitrary headers into HTTP responses or return an arbitrary response body [7][8]. Both vulnerabilities affect all versions of Uvicorn up to, and including, version 0.11.6 [7][8]. Users are strongly advised to upgrade to a newer, patched version of Uvicorn [7][2].
Citations:
- 1: https://pypi.org/project/uvicorn/0.4.6/
- 2: Safety Check Reports 2 Vulnerabilities: CVE-2020-7694 and CVE-2020-7695 Kludex/uvicorn#749
- 3: https://osv.dev/PYSEC-2020-150
- 4: https://osv.dev/vulnerability/CVE-2020-7694
- 5: https://github.com/pypa/advisory-database/blob/main/vulns/uvicorn/PYSEC-2020-150.yaml
- 6: https://osv.dev/vulnerability/GHSA-33c7-2mpw-hg34
- 7: https://www.versioneye.com/Python/uvicorn/0.4.6?page=3
- 8: https://nvd.nist.gov/vuln/detail/cve-2020-7695
- 9: https://app.opencve.io/cve/?product=uvicorn&vendor=encode
🌐 Web query:
fastapi 0.137.1 minimum uvicorn version requirements
💡 Result:
For FastAPI version 0.137.1, the minimum version requirement for Uvicorn (when installed as part of the optional standard dependencies) is uvicorn[standard] >=0.12.0 [1]. While FastAPI includes this requirement in its pyproject.toml to ensure compatibility for standard installations [1], it is generally recommended to use a more recent version of Uvicorn to benefit from performance improvements, bug fixes, and security updates. You can install the standard set of dependencies, including the required Uvicorn version, using the following command [2]: pip install "fastapi[standard]"
Citations:
- 1: https://github.com/fastapi/fastapi/blob/master/pyproject.toml
- 2: https://pypi.org/project/fastapi/
🌐 Web query:
uvicorn 0.27.0 fastapi 0.137.1 compatible
💡 Result:
Uvicorn 0.27.0 and FastAPI 0.137.1 are compatible [1][2]. FastAPI and Uvicorn are separate projects that communicate via the ASGI (Asynchronous Server Gateway Interface) standard [3]. Because they rely on this standardized interface rather than tight, version-specific coupling, they are generally compatible across their respective releases [3]. For context on these specific versions: - Uvicorn 0.27.0 was released on January 22, 2024 [1][4]. - FastAPI 0.137.1 is a much newer release, dated June 15, 2026 [2]. While they are compatible, it is standard practice to ensure you are using a modern version of Uvicorn that supports the latest features and security patches, as Uvicorn has seen many releases since 0.27.0 [5]. You can run them together using standard commands such as uvicorn main:app [6].
Citations:
- 1: https://github.com/pypae/uvicorn/blob/a05ae6426cc8f224f4f1a995f46a901ab0f5644b/CHANGELOG.md
- 2: https://fastapi.tiangolo.com/release-notes/
- 3: Choosing the Right ASGI Server for Deploying FastAPI fastapi/fastapi#2062
- 4: https://www.uvicorn.org/release-notes
- 5: https://uvicorn.dev/release-notes/
- 6: https://fastapi.tiangolo.com/deployment/server-workers/?h=workers
Update uvicorn to 0.27.0 or newer—0.4.6 is incompatible with FastAPI 0.137.1 and carries unpatched security vulnerabilities.
Uvicorn 0.4.6 (released February 2019) is significantly outdated relative to FastAPI 0.137.1 (June 2026). The combination will cause failures and expose your application to known CVEs:
- CVE-2020-7694 / PYSEC-2020-150 / GHSA-33c7-2mpw-hg34 (ANSI escape sequence injection in request logger)
- CVE-2020-7695 / PYSEC-2020-151 / GHSA-f97h-2pfx-f59f (HTTP response splitting via unescaped CRLF in headers)
Both are fixed in uvicorn 0.11.7+. Update to uvicorn 0.27.0+ in src/requirements.txt to ensure compatibility with FastAPI 0.137.1 and patch these vulnerabilities.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-150)
[HIGH] 1-1: uvicorn 0.4.6: undefined
(PYSEC-2020-151)
[HIGH] 1-1: uvicorn 0.4.6: Log injection in uvicorn
[HIGH] 1-1: uvicorn 0.4.6: HTTP response splitting in uvicorn
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/requirements.txt` around lines 1 - 3, Update the uvicorn version
specification from 0.4.6 to 0.27.0 or newer in the requirements.txt file. The
current version 0.4.6 is incompatible with FastAPI 0.137.1 and contains
unpatched security vulnerabilities (CVE-2020-7694 and CVE-2020-7695). Change the
line that currently reads uvicorn==0.4.6 to uvicorn==0.27.0 (or a newer stable
release) to ensure compatibility and patch the known security issues.
Source: Linters/SAST tools
|
Closing this in favor of #583 |
1 participant
This PR updates fastapi from 0.6.4 to 0.137.1.
Changelog
0.137.1
0.137.0
0.136.3
0.136.2
0.136.1
0.136.0
0.135.4
0.135.3
0.135.2
0.135.1
0.135.0
0.134.0
0.133.1
0.133.0
0.132.1
0.132.0
0.131.0
0.130.0
0.129.2
0.129.1
0.129.0
0.128.8
0.128.7
0.128.6
0.128.5
0.128.4
0.128.3
0.128.2
0.128.1